On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java and Flash plugins. And judging from the constant security updates, this seems to be correct.

I am therefore wondering whether I could run Firefox (Iceweasel) as a different user, such as nobody. Even if firefox had a critical bug, the worst that could happen to me is that files owned by nobody would be compromised.

This seems like a graet idea. Is this actually doable? Would this have any disadvantages. Is it really a bluet-proof solution as I imagine it to be?

How would Firefox window owned by nobody access my display?

Is there perhaps a better way to make firefox more secure (i.e. jail) ?

I am using Debian Wheezy and LXDE Desktop environment.


I should have perhaps formulated my question more clearly, but I thought it was too obvious to need elaborating. Ofcourse, I am not running firefox as root. I am running firefox (and everything else) as user martin. My question is concerning running firefox as another user than martin, while being logged in X as martin. I want to protect both root and martin from being compromised.

  • How about a VM? – user36976 Mar 30 '14 at 10:24
  • how would that work ? – Martin Vegter Mar 30 '14 at 10:34
  • 2
    Run a VM with linux and a browser on it – user36976 Mar 30 '14 at 11:15
  • you mean running a VM on my machine? For that I would need virtualization infrastructure on my machine, which would bring new possible security problems. – Martin Vegter Mar 30 '14 at 11:27
  • 1
    @user2675345 the whole point of blue pill root kit is to run your operating system inside a hypervisor, without you noticing. This is impossible without vt-x (your OS would be ridiculously slow without vt-x enabled) – Martin Vegter Mar 31 '14 at 14:23

AppArmor or SELinux is probably a better solution than running Firefox as a different user.

As you mention, running any kind of new software (including Mandatory Access Controls like these) potentially introduces new vulnerabilities (I'm fairly sure some have been found for SELinux) but I think most agree that the tradeoff is worth it.

| improve this answer | |
  • even with AppArmor and SELinux lockdown. If in the same XSession the GUI can be another vector to attack the systen. Also most often it is impossible to avoid IPC like D-Bus being active, which again can be a vector. Lastly the browser runs on the system and can attack services only available from localhost. Just added make aware... LSM might not be enough, yet good – humanityANDpeace Mar 31 '14 at 21:53

Have you thought about using something like Tails(https://tails.boum.org/)? As was suggested above you could use it with a Vm, but based on what it is fundamentally for you wouldn't need to keep an instance on your machine for it. There are also things like sandfox(http://igurublog.wordpress.com/downloads/script-sandfox/) that allow you to run firefox in a sandbox as well as other chroot solutions online.

| improve this answer | |

paranoid mode:

  • install a different linux on a different machine, better, use a ro-mounted distro from cd like knoppix or so (virtualbox and kvm is your friend)
  • run your browser from that other machine, using x-forwaring or x2go (free and good linux terminalserver/client-solution, works very nice on debian)
  • harden this browser with noscript, adblockplus, ghostery, request-policy and cert-checker, no 3rd-party-cookies, etc
  • instead of linux, use bsd, haiku or plan9
| improve this answer | |
  • What is the logic behind don't use Linux? It's not that obscure operating systems are more secure. If there are not enough developers to fix bugs or improve security features then it's actually the opposite. Case in point: FreeBSD does not even have ASLR, something Linux has had for over 10 years. Even Microsoft introduced it in Windows Vista. – user2675345 Mar 31 '14 at 12:57
  • can the x-forwarding still allow attacks? i.e. how does the browser interact with clipboard etc etc? Still I guess its the safest solution yet! – humanityANDpeace Mar 31 '14 at 13:53
  • > can the x-forwarding still allow attacks? yes, but onbly against that system the browser runs on. clipboard works just fine from linux to linux and might work too with windows and a XServer – that guy from over there Mar 31 '14 at 14:22
  • Installing 3rd party Addons to "harden" my browser is ridiculous. – Martin Vegter Mar 31 '14 at 14:31
  • @Martin Vegter Noscript will block Javascript, Java and Flash by default which is how much browser exploits occur in the first place. – user2675345 Mar 31 '14 at 18:10

You are on the right track realizing that the Xclient (in this case Firefox) will not be able to access an Xserver running under a different user (by default).

The simplest solution would be to ssh -X webuser@localhost firefox (note I would explicitly NOT use the 'nobody' account - this should not be used for this purpose) - which automatically deals with the change if userid, the transferral of xauth tokens and setting up the DISPLAY. The ssh tunnel is a bit of an innefficient overhead - the laternative is to learn how to use xauth yourself (hint xhost +localhost is not very secure either).

But you realy should NOT be logging in as root to browse the internet in the first place.

| improve this answer | |

You could create account, without any privileges and used it for browsing but there are exploits that may obtain root privileges. There's nothing that can secure you.

| improve this answer | |
  • 1
    Not all exploits obtain root privileges. Perhaps my solution is not perfect, but better than a poke in the eye. – Martin Vegter Mar 30 '14 at 11:14
  • 1
    Both are true. Your best chance is to run the browser sandboxed – user3395407 Mar 30 '14 at 12:20
  • @user3395407 good idea, maybe. How is this done? you will provide your though the room of an alternative answer? – humanityANDpeace Mar 30 '14 at 17:02
  • verahill.blogspot.com/2012/10/… chroot for iceweasel =). But in my option if you don't keep super mega hyper secret documents on your PC this is useless because the most drive-by's target MS Windows. There is very little chance that malware will infect linux machine via browser exploit. – user3395407 Mar 31 '14 at 10:20
  • @user3395407 chroot for iceweasel uses the same XServer and hence allows for attacks via the GUI and via the network, maybe even D-Bus. So yes, its a sandbox, but not a supesafe one. – humanityANDpeace Mar 31 '14 at 13:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.